These are good things to measure but without a maintainer, the rest are sort of meaningless. Number of bugs doesn't matter if noone is fixing them. Seriously a package can't be called mature if it has any bugs and there is noone responsible to fix, confirm, prioritize them. This is one of the major reasons for delayed release schedule for OpenACS and .LRN. The OpenACS core team takes responsibility for all OpenACS core packages in theory, and should delgate some of this to volunteers, if possible.
This leaves the huge number of optional packages. I think a volunteer maintainer needs to monitor the bugtracker and forums discussions about a particular package. It doesn't mean they need to fix every bug by themselves, but if the maintainer can't fix a bug for any reason, the maintainer should fix help, or another volunteer to fix the bug.
Another way to help clear up bugs more quickly is to have the submitter submit an automated test either directly to CVS or as a patch. This test should confirm the existance of the bug. This serves two purposes, one, it provides an easier way to reproduce the error, and two, provied an easier way to know when its fixed! Not every person who submits a bug has to do this, of course, but anyone with some knowledge of the toolkit can try.
So, whatever, rules you put in place to measure the maturity level of a package, you need someone to carry out and enforce those rules, otherwise the name will not have any meaning.
